That's what we are currently doing now.

I was referring to cases where the account holder wants to use an custom domain name e.g. ads.mywebsite.com, instead of the generic mywebsite.mysaasprovider.com.

In that case, we'll need to host their certificate within our Pound load balancer and get it to listen on a dedicated IP.